CDXRHookV3 on Ethereum

Uniswap v4 Hook Contract 0x6e6451019a1a74853b4974485ae225c63462c0c0 on Ethereum · Access control · Verified contract

Volume (24h)
$642
Value locked (TVL)
$7.47K
All-time volume
$26.64K
Pools using this hook
1
Swaps (24h)
7 (7 traders)
Total swaps
375

What it does

A Uniswap v4 hook for one CDXR/USDT pool that restricts CDXR sells to allowlisted sellers routed through trusted routers and enforces rolling USDT spend limits per seller.

How it works step by step

  • Restricts the hook to a single pool identified by the constructor-computed authorizedPoolId
  • Gates CDXR sells (zeroForOne) by allowlist, via the external PermissionModule.checkSwap
  • Derives the true seller from the trusted router's msgSender() and ignores attacker-writable hookData
  • Enforces rolling spend limits by recording actual USDT received per seller in afterSwap via recordSwap
  • Honors a global pause flag from the PermissionModule that blocks swaps including buys
  • Leaves liquidity add, remove, donate and initialize callbacks as no-op stubs
Swap behaviour
beforeSwap reverts for non-authorized pools and when paused. For CDXR sells it identifies the seller through a trusted router's msgSender and checks the allowlist. afterSwap records the actual CDXR sold and USDT received against that seller's spend limit. Buys are not gated beyond the pause check.
Liquidity behaviour
No liquidity callbacks. Add and remove liquidity hooks are stubs that return their selectors with no logic.
Fee behaviour
Uses the pool's static fee. The hook returns a zero BeforeSwapDelta and zero fee override, so it neither sets dynamic fees nor takes a fee cut.
Owner & admin controls
Owner (Ownable, single key) can set the PermissionModule address via setPermissionModule, add or remove trusted routers via setTrustedRouter, and renounce or transfer ownership. The pause state lives in the external PermissionModule, which the owner can repoint, so pausing and allowlist/spend-limit control are effectively owner-controlled through that module.

Enabled Uniswap v4 callbacks

beforeSwap, afterSwap

beforeSwap: checks the pool is the authorized CDXR/USDT pool, checks the pause flag, and for CDXR sells (zeroForOne) resolves the seller via the trusted router and calls checkSwap on the allowlist module. afterSwap: for CDXR sells re-resolves the seller, reads actual CDXR sold and USDT received from the BalanceDelta, and calls recordSwap to enforce rolling spend limits.

Security & trust assessment

Risk level: medium (verified source, high confidence).

Who controls it: A single owner key controls which routers are trusted, which PermissionModule is used, and (indirectly) pausing and allowlisting. Malicious or compromised owner keys could add a malicious router to the trusted set or point the hook at a module that always allows or always blocks sells, which would block selling or bypass limits for all users.

Risk to user funds: The hook does not custody or move pool funds; it returns zero deltas and cannot take tokens. It can, however, revert swaps: CDXR sells can be blocked by the allowlist, spend limits, the pause flag, or an untrusted router, and buys can be blocked when paused. Funds are at risk indirectly if the owner repoints the permission module or trusts a malicious router, which could block trades or misreport seller identity.

Security findings

  • [medium] Identity relies on owner-curated trusted routers: The seller identity is derived from IMsgSender(sender).msgSender() on owner-trusted routers, so the security of sell gating depends on each trusted router honestly exposing its transient locker. A malicious or buggy router added via setTrustedRouter would break the identity guarantee.
  • [medium] Pause halts buys and sells: The pause check in beforeSwap runs before the zeroForOne branch, so pausing blocks CDXR buys as well as sells. The owner or pauser can halt all trading in the pool.
  • [medium] Owner can swap the permission module: setPermissionModule lets the owner replace the entire allowlist and spend-limit module in one transaction, so a compromised key could redirect all sell checks to an arbitrary contract.
  • [low] Single-key ownership with no timelock: Ownership is a single EOA or key with no timelock or multisig enforced in the contract, and ownership can be renounced or transferred immediately.
  • [info] No custody of pool funds by the hook: The hook does not hold user tokens; it only gates and records swaps and returns zero deltas, so funds are held by the PoolManager and pool liquidity, not by the hook.

Contract details

Verified source
Yes (CDXRHookV3)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
3,688 bytes
Upgradeable proxy
No
Detected patterns
ownable

Pools using CDXRHookV3